Skip to content
Fygë

Privacy policy

Last updated: 23 September 2026

This policy explains how Fygë Food Oy handles personal data when you visit fyge.fi, ask us for a quote, order from us, subscribe to our newsletter or apply for a job. It applies to fyge.fi, order.fyge.fi and our other Fygë and Monda websites and services.

1. Who we are

The controller responsible for your personal data is:

Fygë Food Oy (business ID 3197589-8) Porkkalankatu 3, 00180 Helsinki, Finland Privacy contact: hello@fyge.fi

Contact us at that address about anything in this policy, including exercising your rights.

2. What data we collect

Data you give us

  • Contact details: name, company, job title, email, phone number.
  • Inquiry and order details: event or delivery date, address, number of guests, menu choices, messages you write to us, and how you heard about us.
  • Dietary information: we ask for dietary needs as counts per order (for example "3 × gluten-free"). If you tell us about the needs of a named person, we use that only to prepare the order safely and only with the consent described in section 4.
  • Billing details: invoicing address and company details. For card and MobilePay payments in our online shop, your payment card data is handled by our payment provider. We never see or store full card numbers.
  • Newsletter: your email address, your language and your consent.
  • Job applications: your CV, application and the contact details you send us.

Data collected automatically

  • Technical data: IP address, browser and device type, pages visited, and referring site. This comes from server logs and, if you consent, from analytics cookies (see section 9).
  • Marketing source: when you submit a form we record which page and which channel you arrived from, for that submission only.
  • Delivery tracking: when your order is on its way, we email you a live-tracking link. We record whether the link was sent and opened.
  • Answering inquiries and preparing quotes — steps before a contract (GDPR Art. 6(1)(b)). For company contact persons: our legitimate interest in serving business customers (6(1)(f)).
  • Handling orders, deliveries, tracking links and customer service — performance of a contract (6(1)(b)) or legitimate interest for company contact persons (6(1)(f)).
  • Payments, invoicing and bookkeeping — legal obligation under the Finnish Accounting Act (6(1)(c)) and contract (6(1)(b)).
  • Managing customer relationships and B2B sales follow-up — legitimate interest (6(1)(f)).
  • Newsletter — consent (6(1)(a)). You can unsubscribe at any time.
  • Website analytics and advertising measurement — consent through the cookie banner (6(1)(a)).
  • Security, fraud prevention and keeping our systems running — legitimate interest (6(1)(f)).
  • Recruitment — steps before a contract and legitimate interest (6(1)(b), (f)).
  • Legal claims and requests from authorities — legal obligation or legitimate interest (6(1)(c), (f)).

Where we rely on legitimate interest, we have weighed it against your rights. You can object at any time (see section 7).

4. Dietary and allergy information

Allergy or dietary information linked to an identifiable person is health data under GDPR Art. 9. We process it only when you explicitly consent (Art. 9(2)(a)) and only to prepare that order safely. Wherever possible, please tell us counts rather than names. We delete names linked to dietary needs within 30 days of the order being delivered.

5. Who we share data with

We do not sell your personal data. We do not share it with third parties for their own marketing.

We use service providers who process data on our behalf under data processing agreements. By category, with what they do and where they process data:

  • Hosting provider for our website, marketing platform and applications — Finland / EU.
  • Order and procurement coordination platform — Finland / EU.
  • CRM and email marketing provider — EU / United States.
  • Online shop and order management platform behind order.fyge.fi — Australia and the United States.
  • Payment provider for card and MobilePay payments in the online shop — EU and United States.
  • Transactional email provider for the confirmation and notification emails our website sends — United States.
  • AI service that reads the free-text message in a quote request into structured fields (date, headcount, dietary counts) so we can answer faster — United States. Your message is not used to train models.
  • Website analytics: Google Tag Manager and Google Analytics 4, only with your consent — EU and United States (see section 9).
  • Accounting firm for bookkeeping and invoicing — Finland.

We will tell you the specific providers on request (see section 7).

For its own fraud-prevention and legal obligations, our payment provider also acts as an independent controller. Its own privacy policy applies to that processing.

We may also disclose data:

  • to authorities when the law requires it
  • to professional advisers such as auditors and lawyers
  • to a buyer or successor if all or part of our business is reorganised, merged or sold. This happens under confidentiality, and the recipient must keep protecting your data.

6. Transfers outside the EU/EEA

Some of our providers process data outside the EU/EEA:

  • the online shop and order management platform: Australia and the United States
  • the payment, transactional email, AI, CRM and analytics providers (Google): the United States

Where no EU adequacy decision applies, we rely on the European Commission's Standard Contractual Clauses, included in the providers' data processing agreements. For US providers certified under the EU–US Data Privacy Framework, we rely on that framework. You can ask us for a copy of the relevant safeguards.

7. Your rights

You have the right to:

  • access the personal data we hold about you
  • have incorrect data corrected
  • have your data erased when we no longer need it or you withdraw consent
  • restrict processing
  • receive your data in a machine-readable format (portability)
  • object to processing based on legitimate interest, and to direct marketing at any time
  • withdraw your consent at any time. This does not affect processing already carried out.

To use your rights, or to ask which specific providers handle your data, email hello@fyge.fi. We reply within one month.

You can also lodge a complaint with the Finnish supervisory authority: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.

8. How long we keep data

  • Inquiries that didn't lead to an order: 24 months from last contact.
  • Customer and order data: for the customer relationship plus 3 years (the general limitation period for claims).
  • Accounting records: 6 years (vouchers) and 10 years (books and financial statements) under the Accounting Act.
  • Named dietary information: 30 days after the order is delivered.
  • Newsletter subscription: until you unsubscribe.
  • Analytics data: 14 months (Google Analytics retention setting).
  • Server logs: 90 days.
  • Job applications: 24 months after the recruitment ends, unless you agree to a longer period.

9. Cookies

Strictly necessary storage keeps the site working and remembers your choices. It is always on:

  • fyge-consent (browser storage, Fygë) — remembers whether you accepted or declined analytics. Kept until you clear it or change your choice.
  • NEXT_LOCALE (cookie, Fygë) — remembers the language you chose, for one year.
  • Session cookies (Fygë) — only for our staff signed in to the site's administration; they are never set for visitors.

All other cookies are off until you accept them in our cookie banner. You can change your choice at any time through the "Cookie settings" link in the footer.

  • Analytics — _ga, _ga_* (Google Analytics 4, loaded through Google Tag Manager) — visitor statistics — up to 2 years.

Google tags run under Google Consent Mode v2, so they respect your choice. If we add advertising measurement to the site, it will load only under the same consent and be listed here.

10. Security

Data is encrypted in transit (TLS). Access is limited to people who need it for their work, and we require the same from our service providers. If a data breach puts your rights at risk, we will notify you and the authorities as the law requires.

11. Children

Our services are aimed at businesses and adults. We do not knowingly collect data from children under 13, and we delete it if we find we have.

12. Changes to this policy

When this policy changes, we update the date at the top. We will notify customers by email of significant changes.